paychex-pdftron@99.9.1

Analysis

paychex-pdftron@99.9.1 is an empty placeholder package (index.js contains only `module.exports = {}`, no lifecycle scripts, no binaries) whose only purpose is to pull a payload from outside the npm registry: it declares a dependency on the raw tarball hxxps://ltidi[.]storage.googleapis[.]com/depenconf/ltidisafe-4.0.5[.]tgz. Installing the package therefore fetches and installs code hosted on a Google Cloud Storage bucket rather than from the registry, bypassing registry audit and provenance checks; the "depenconf" path and the 99.9.1 version on a corporate-looking name are consistent with a dependency-confusion/internal-name-collision lure. The package itself contains no executable logic — the second-stage code is the remote tarball at that URL.